How to transfer logs to the Splunk Server without open port?

[fyd2]

Dear Sir or Madam,

Could you please advise me about transferring logs to the Splunk server when there is no open port for listening?

The only open port is 80 which is reversed proxied to 8000 through Apache configurations for Splunk web UI as shown below:

<VirtualHost *:80>

ProxyPass         /  http://localhost:8000/                                                                                               

ProxyPassReverse  /  http://localhost:8000/                                                                                                               

</VirtualHost>

I Will be so grateful if you advise me about the best solution for transferring logs without opening an additional port?

I really appreciate your help and support.

Kind Regards,

Farid

[fyd2]

I really appreciate your help and support

[richgalloway · Accepted solution]

If Splunk is running on a separate server from where the data is stored then it is not possible to get the logs transferred without opening port 9997 (or whatever port you have designated for receiving data).

If the logs are on the same server then Splunk can read them directly without opening another port.